@seed-ship/mcp-ui-solid 1.2.2 → 2.0.0

package/dist/services/index.d.ts

@@ -3,6 +3,6 @@
  *
  * Business logic for component validation and registry management
  */
-export { validateComponent, validateLayout, DEFAULT_RESOURCE_LIMITS } from './validation';
+export { validateComponent, validateLayout, validateIframeDomain, DEFAULT_RESOURCE_LIMITS, DEFAULT_IFRAME_DOMAINS, } from './validation';
 export { ComponentRegistry } from './component-registry';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAEzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/services/validation.cjs

@@ -8,12 +8,51 @@ const DEFAULT_RESOURCE_LIMITS = {
   renderTimeout: 5e3
   // 5 seconds
 };
-const ALLOWED_IFRAME_DOMAINS = [
+const DEFAULT_IFRAME_DOMAINS = [
+  // Charts
   "quickchart.io",
   "www.quickchart.io",
+  // Deposium
   "deposium.com",
   "deposium.vip",
-  "localhost"
+  "deposium.ai",
+  // Development
+  "localhost",
+  // Video providers (Sprint 5)
+  "youtube.com",
+  "www.youtube.com",
+  "youtube-nocookie.com",
+  "www.youtube-nocookie.com",
+  "youtu.be",
+  "vimeo.com",
+  "player.vimeo.com",
+  // Code playgrounds (Sprint 7)
+  "codepen.io",
+  "codesandbox.io",
+  "stackblitz.com",
+  "jsfiddle.net",
+  // Design tools (Sprint 7)
+  "figma.com",
+  "www.figma.com",
+  "miro.com",
+  // Google services (Sprint 7)
+  "docs.google.com",
+  "drive.google.com",
+  "sheets.google.com",
+  "slides.google.com",
+  "maps.google.com",
+  "www.google.com",
+  "datastudio.google.com",
+  "lookerstudio.google.com",
+  // Productivity (Sprint 7)
+  "airtable.com",
+  "notion.so",
+  "www.notion.so",
+  // Maps (Sprint 7)
+  "openstreetmap.org",
+  "www.openstreetmap.org",
+  // Analytics/Dashboards (Sprint 7)
+  "public.tableau.com"
 ];
 function validateGridPosition(position) {
   const errors = [];
@@ -170,11 +209,18 @@ function validatePayloadSize(component, limits = DEFAULT_RESOURCE_LIMITS) {
 function sanitizeString(input) {
   return input.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/on\w+="[^"]*"/gi, "").replace(/javascript:/gi, "");
 }
-function validateIframeDomain(url) {
+function validateIframeDomain(url, options) {
+  if ((options == null ? void 0 : options.policy) === "allow-all") {
+    return { valid: true };
+  }
   try {
     const parsedUrl = new URL(url);
     const domain = parsedUrl.hostname;
-    const isAllowed = ALLOWED_IFRAME_DOMAINS.some(
+    let effectiveWhitelist = DEFAULT_IFRAME_DOMAINS;
+    if ((options == null ? void 0 : options.policy) === "extend" && options.customDomains) {
+      effectiveWhitelist = [...DEFAULT_IFRAME_DOMAINS, ...options.customDomains];
+    }
+    const isAllowed = effectiveWhitelist.some(
       (allowed) => domain === allowed || domain.endsWith(`.${allowed}`) || allowed === "localhost"
     );
     if (!isAllowed) {
@@ -203,7 +249,8 @@ function validateIframeDomain(url) {
     };
   }
 }
-function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
+function validateComponent(component, options) {
+  const limits = (options == null ? void 0 : options.limits) ?? DEFAULT_RESOURCE_LIMITS;
   const errors = [];
   const gridResult = validateGridPosition(component.position);
   if (!gridResult.valid) {
@@ -214,19 +261,21 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
     errors.push(...sizeResult.errors || []);
   }
   switch (component.type) {
-    case "chart":
+    case "chart": {
       const chartResult = validateChartComponent(component.params, limits);
       if (!chartResult.valid) {
         errors.push(...chartResult.errors || []);
       }
       break;
-    case "table":
+    }
+    case "table": {
       const tableResult = validateTableComponent(component.params, limits);
       if (!tableResult.valid) {
         errors.push(...tableResult.errors || []);
       }
       break;
-    case "metric":
+    }
+    case "metric": {
       const metricParams = component.params;
       if (!metricParams.title || !metricParams.value) {
         errors.push({
@@ -236,7 +285,8 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
         });
       }
       break;
-    case "text":
+    }
+    case "text": {
       const textParams = component.params;
       if (!textParams.content) {
         errors.push({
@@ -246,7 +296,8 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
         });
       }
       break;
-    case "iframe":
+    }
+    case "iframe": {
       const iframeParams = component.params;
       if (!iframeParams.url) {
         errors.push({
@@ -254,9 +305,18 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
           message: "Iframe component must have url",
           code: "INVALID_IFRAME"
         });
+      } else {
+        const iframeResult = validateIframeDomain(iframeParams.url, {
+          policy: options == null ? void 0 : options.iframePolicy,
+          customDomains: options == null ? void 0 : options.customIframeDomains
+        });
+        if (!iframeResult.valid) {
+          errors.push(...iframeResult.errors || []);
+        }
       }
       break;
-    case "image":
+    }
+    case "image": {
       const imageParams = component.params;
       if (!imageParams.url) {
         errors.push({
@@ -266,7 +326,8 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
         });
       }
       break;
-    case "link":
+    }
+    case "link": {
       const linkParams = component.params;
       if (!linkParams.url) {
         errors.push({
@@ -276,7 +337,8 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
         });
       }
       break;
-    case "action":
+    }
+    case "action": {
       const actionParams = component.params;
       if (!actionParams.label) {
         errors.push({
@@ -286,6 +348,7 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
         });
       }
       break;
+    }
     default:
       errors.push({
         path: "type",
@@ -298,7 +361,7 @@ function validateComponent(component, limits = DEFAULT_RESOURCE_LIMITS) {
     errors: errors.length > 0 ? errors : void 0
   };
 }
-function validateLayout(layout, limits = DEFAULT_RESOURCE_LIMITS) {
+function validateLayout(layout, options) {
   var _a;
   const errors = [];
   if (layout.components.length === 0) {
@@ -316,7 +379,7 @@ function validateLayout(layout, limits = DEFAULT_RESOURCE_LIMITS) {
     });
   }
   for (const [index, component] of layout.components.entries()) {
-    const result = validateComponent(component, limits);
+    const result = validateComponent(component, options);
     if (!result.valid) {
       errors.push(
         ...((_a = result.errors) == null ? void 0 : _a.map((error) => ({
@@ -338,10 +401,90 @@ function validateLayout(layout, limits = DEFAULT_RESOURCE_LIMITS) {
     errors: errors.length > 0 ? errors : void 0
   };
 }
+function validateFieldValue(value, field) {
+  if (field.required) {
+    if (value === void 0 || value === null || value === "") {
+      return { valid: false, error: `${field.label || field.name} is required` };
+    }
+    if (field.type === "checkbox" && value !== true) {
+      return { valid: false, error: `${field.label || field.name} must be checked` };
+    }
+  }
+  if (value === void 0 || value === null || value === "") {
+    return { valid: true };
+  }
+  switch (field.type) {
+    case "text":
+    case "textarea":
+    case "password":
+      if (field.minLength && String(value).length < field.minLength) {
+        return { valid: false, error: `Minimum ${field.minLength} characters required` };
+      }
+      if (field.maxLength && String(value).length > field.maxLength) {
+        return { valid: false, error: `Maximum ${field.maxLength} characters allowed` };
+      }
+      if (field.pattern && !new RegExp(field.pattern).test(String(value))) {
+        return { valid: false, error: "Invalid format" };
+      }
+      break;
+    case "email":
+      if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(String(value))) {
+        return { valid: false, error: "Invalid email address" };
+      }
+      break;
+    case "number": {
+      const numValue = Number(value);
+      if (isNaN(numValue)) {
+        return { valid: false, error: "Must be a valid number" };
+      }
+      if (field.min !== void 0 && numValue < field.min) {
+        return { valid: false, error: `Minimum value is ${field.min}` };
+      }
+      if (field.max !== void 0 && numValue > field.max) {
+        return { valid: false, error: `Maximum value is ${field.max}` };
+      }
+      break;
+    }
+    case "date":
+      if (field.minDate && value < field.minDate) {
+        return { valid: false, error: `Date must be after ${field.minDate}` };
+      }
+      if (field.maxDate && value > field.maxDate) {
+        return { valid: false, error: `Date must be before ${field.maxDate}` };
+      }
+      break;
+    case "select":
+    case "radio":
+      if (field.options && field.options.length > 0) {
+        const validValues = field.options.map((opt) => opt.value);
+        if (!validValues.includes(String(value))) {
+          return { valid: false, error: "Please select a valid option" };
+        }
+      }
+      break;
+  }
+  return { valid: true };
+}
+function validateFormData(data, fields) {
+  const errors = {};
+  for (const field of fields) {
+    const result = validateFieldValue(data[field.name], field);
+    if (!result.valid && result.error) {
+      errors[field.name] = result.error;
+    }
+  }
+  return {
+    valid: Object.keys(errors).length === 0,
+    errors
+  };
+}
+exports.DEFAULT_IFRAME_DOMAINS = DEFAULT_IFRAME_DOMAINS;
 exports.DEFAULT_RESOURCE_LIMITS = DEFAULT_RESOURCE_LIMITS;
 exports.sanitizeString = sanitizeString;
 exports.validateChartComponent = validateChartComponent;
 exports.validateComponent = validateComponent;
+exports.validateFieldValue = validateFieldValue;
+exports.validateFormData = validateFormData;
 exports.validateGridPosition = validateGridPosition;
 exports.validateIframeDomain = validateIframeDomain;
 exports.validateLayout = validateLayout;

package/dist/services/validation.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"validation.cjs","sources":["../../src/services/validation.ts"],"sourcesContent":["/**\n * Component Validation Service\n * Phase 0: Resource Limits & Schema Validation\n *\n * Validates LLM-generated components against:\n * - JSON schema\n * - Resource limits (data points, payload size, grid bounds)\n * - Security constraints (domain whitelist, XSS prevention)\n */\n\nimport type {\n  UIComponent,\n  UILayout,\n  ValidationResult,\n  ResourceLimits,\n  ChartComponentParams,\n  TableComponentParams,\n} from '../types'\n\n/**\n * Default resource limits (configurable via env)\n */\nexport const DEFAULT_RESOURCE_LIMITS: ResourceLimits = {\n  maxDataPoints: 1000,\n  maxTableRows: 100,\n  maxPayloadSize: 50 * 1024, // 50KB\n  renderTimeout: 5000, // 5 seconds\n}\n\n/**\n * Allowed iframe domains (whitelist)\n * Must match CSP frame-src directive\n */\nconst ALLOWED_IFRAME_DOMAINS = [\n  'quickchart.io',\n  'www.quickchart.io',\n  'deposium.com',\n  'deposium.vip',\n  'localhost',\n]\n\n/**\n * Validate grid position bounds (1-12 columns)\n */\nexport function validateGridPosition(position: UIComponent['position']): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // ✅ PHASE 3 FIX: Defensive check for undefined position\n  if (!position) {\n    return {\n      valid: false,\n      errors: [\n        {\n          path: 'position',\n          message: 'Position is required',\n          code: 'MISSING_POSITION',\n        },\n      ],\n    }\n  }\n\n  if (position.colStart < 1 || position.colStart > 12) {\n    errors.push({\n      path: 'position.colStart',\n      message: 'Column start must be between 1 and 12',\n      code: 'INVALID_GRID_COL_START',\n    })\n  }\n\n  if (position.colSpan < 1 || position.colSpan > 12) {\n    errors.push({\n      path: 'position.colSpan',\n      message: 'Column span must be between 1 and 12',\n      code: 'INVALID_GRID_COL_SPAN',\n    })\n  }\n\n  if (position.colStart + position.colSpan - 1 > 12) {\n    errors.push({\n      path: 'position',\n      message: 'Column start + span exceeds grid width (12)',\n      code: 'GRID_OVERFLOW',\n    })\n  }\n\n  if (position.rowStart !== undefined && position.rowStart < 1) {\n    errors.push({\n      path: 'position.rowStart',\n      message: 'Row start must be >= 1',\n      code: 'INVALID_GRID_ROW_START',\n    })\n  }\n\n  if (position.rowSpan !== undefined && position.rowSpan < 1) {\n    errors.push({\n      path: 'position.rowSpan',\n      message: 'Row span must be >= 1',\n      code: 'INVALID_GRID_ROW_SPAN',\n    })\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate chart component against resource limits\n */\nexport function validateChartComponent(\n  params: ChartComponentParams,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // Validate data points count\n  const totalDataPoints = params.data.datasets.reduce(\n    (sum, dataset) => sum + dataset.data.length,\n    0\n  )\n\n  if (totalDataPoints > limits.maxDataPoints) {\n    errors.push({\n      path: 'params.data',\n      message: `Chart exceeds max data points: ${totalDataPoints} > ${limits.maxDataPoints}`,\n      code: 'RESOURCE_LIMIT_EXCEEDED',\n    })\n  }\n\n  // Validate labels match dataset length\n  const expectedLength = params.data.labels.length\n  for (const [index, dataset] of params.data.datasets.entries()) {\n    if (dataset.data.length !== expectedLength) {\n      errors.push({\n        path: `params.data.datasets[${index}]`,\n        message: `Dataset length mismatch: expected ${expectedLength}, got ${dataset.data.length}`,\n        code: 'DATA_LENGTH_MISMATCH',\n      })\n    }\n  }\n\n  // Validate numeric data\n  for (const [index, dataset] of params.data.datasets.entries()) {\n    for (const [dataIndex, value] of dataset.data.entries()) {\n      if (typeof value !== 'number' || !Number.isFinite(value)) {\n        errors.push({\n          path: `params.data.datasets[${index}].data[${dataIndex}]`,\n          message: `Invalid data value: ${value} (must be finite number)`,\n          code: 'INVALID_DATA_TYPE',\n        })\n      }\n    }\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate table component against resource limits\n */\nexport function validateTableComponent(\n  params: TableComponentParams,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // Validate row count\n  if (params.rows.length > limits.maxTableRows) {\n    errors.push({\n      path: 'params.rows',\n      message: `Table exceeds max rows: ${params.rows.length} > ${limits.maxTableRows}`,\n      code: 'RESOURCE_LIMIT_EXCEEDED',\n    })\n  }\n\n  // Validate columns\n  if (params.columns.length === 0) {\n    errors.push({\n      path: 'params.columns',\n      message: 'Table must have at least one column',\n      code: 'EMPTY_COLUMNS',\n    })\n  }\n\n  // Validate column keys are unique\n  const columnKeys = new Set<string>()\n  for (const [index, column] of params.columns.entries()) {\n    if (columnKeys.has(column.key)) {\n      errors.push({\n        path: `params.columns[${index}]`,\n        message: `Duplicate column key: ${column.key}`,\n        code: 'DUPLICATE_COLUMN_KEY',\n      })\n    }\n    columnKeys.add(column.key)\n  }\n\n  // Validate rows have valid data for defined columns\n  for (const [rowIndex, row] of params.rows.entries()) {\n    for (const column of params.columns) {\n      if (!(column.key in row)) {\n        errors.push({\n          path: `params.rows[${rowIndex}]`,\n          message: `Missing column key: ${column.key}`,\n          code: 'MISSING_COLUMN_DATA',\n        })\n      }\n    }\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate payload size\n */\nexport function validatePayloadSize(\n  component: UIComponent,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const payloadSize = JSON.stringify(component).length\n\n  if (payloadSize > limits.maxPayloadSize) {\n    return {\n      valid: false,\n      errors: [\n        {\n          path: 'component',\n          message: `Payload size exceeds limit: ${payloadSize} > ${limits.maxPayloadSize} bytes`,\n          code: 'PAYLOAD_TOO_LARGE',\n        },\n      ],\n    }\n  }\n\n  return { valid: true }\n}\n\n/**\n * Sanitize string to prevent XSS\n * Basic implementation - DOMPurify used at render time\n */\nexport function sanitizeString(input: string): string {\n  return input\n    .replace(/<script\\b[^<]*(?:(?!<\\/script>)<[^<]*)*<\\/script>/gi, '')\n    .replace(/on\\w+=\"[^\"]*\"/gi, '')\n    .replace(/javascript:/gi, '')\n}\n\n/**\n * Validate iframe domain against whitelist\n */\nexport function validateIframeDomain(url: string): ValidationResult {\n  try {\n    const parsedUrl = new URL(url)\n    const domain = parsedUrl.hostname\n\n    const isAllowed = ALLOWED_IFRAME_DOMAINS.some(\n      (allowed) => domain === allowed || domain.endsWith(`.${allowed}`) || allowed === 'localhost'\n    )\n\n    if (!isAllowed) {\n      return {\n        valid: false,\n        errors: [\n          {\n            path: 'url',\n            message: `Domain not whitelisted: ${domain}`,\n            code: 'DOMAIN_NOT_WHITELISTED',\n          },\n        ],\n      }\n    }\n\n    return { valid: true }\n  } catch (error) {\n    return {\n      valid: false,\n      errors: [\n        {\n          path: 'url',\n          message: 'Invalid URL format',\n          code: 'INVALID_URL',\n        },\n      ],\n    }\n  }\n}\n\n/**\n * Validate entire component\n */\nexport function validateComponent(\n  component: UIComponent,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // Validate grid position\n  const gridResult = validateGridPosition(component.position)\n  if (!gridResult.valid) {\n    errors.push(...(gridResult.errors || []))\n  }\n\n  // Validate payload size\n  const sizeResult = validatePayloadSize(component, limits)\n  if (!sizeResult.valid) {\n    errors.push(...(sizeResult.errors || []))\n  }\n\n  // Type-specific validation\n  switch (component.type) {\n    case 'chart':\n      const chartResult = validateChartComponent(component.params as ChartComponentParams, limits)\n      if (!chartResult.valid) {\n        errors.push(...(chartResult.errors || []))\n      }\n      break\n\n    case 'table':\n      const tableResult = validateTableComponent(component.params as TableComponentParams, limits)\n      if (!tableResult.valid) {\n        errors.push(...(tableResult.errors || []))\n      }\n      break\n\n    case 'metric':\n      // Basic validation for metrics\n      const metricParams = component.params as any\n      if (!metricParams.title || !metricParams.value) {\n        errors.push({\n          path: 'params',\n          message: 'Metric must have title and value',\n          code: 'INVALID_METRIC',\n        })\n      }\n      break\n\n    case 'text':\n      // Basic validation for text\n      const textParams = component.params as any\n      if (!textParams.content) {\n        errors.push({\n          path: 'params',\n          message: 'Text component must have content',\n          code: 'INVALID_TEXT',\n        })\n      }\n      break\n\n    case 'iframe':\n      // Basic validation for iframe\n      const iframeParams = component.params as any\n      if (!iframeParams.url) {\n        errors.push({\n          path: 'params',\n          message: 'Iframe component must have url',\n          code: 'INVALID_IFRAME',\n        })\n      }\n      break\n\n    case 'image':\n      // Basic validation for image\n      const imageParams = component.params as any\n      if (!imageParams.url) {\n        errors.push({\n          path: 'params',\n          message: 'Image component must have url',\n          code: 'INVALID_IMAGE',\n        })\n      }\n      break\n\n    case 'link':\n      // Basic validation for link\n      const linkParams = component.params as any\n      if (!linkParams.url) {\n        errors.push({\n          path: 'params',\n          message: 'Link component must have url',\n          code: 'INVALID_LINK',\n        })\n      }\n      break\n\n    case 'action':\n      // Basic validation for action\n      const actionParams = component.params as any\n      if (!actionParams.label) {\n        errors.push({\n          path: 'params',\n          message: 'Action component must have label',\n          code: 'INVALID_ACTION',\n        })\n      }\n      break\n\n    default:\n      errors.push({\n        path: 'type',\n        message: `Unknown component type: ${component.type}`,\n        code: 'UNKNOWN_COMPONENT_TYPE',\n      })\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate entire layout\n */\nexport function validateLayout(\n  layout: UILayout,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // Validate component count\n  if (layout.components.length === 0) {\n    errors.push({\n      path: 'components',\n      message: 'Layout must have at least one component',\n      code: 'EMPTY_LAYOUT',\n    })\n  }\n\n  if (layout.components.length > 12) {\n    errors.push({\n      path: 'components',\n      message: `Layout exceeds max components: ${layout.components.length} > 12`,\n      code: 'TOO_MANY_COMPONENTS',\n    })\n  }\n\n  // Validate each component\n  for (const [index, component] of layout.components.entries()) {\n    const result = validateComponent(component, limits)\n    if (!result.valid) {\n      errors.push(\n        ...(result.errors?.map((error) => ({\n          ...error,\n          path: `components[${index}].${error.path}`,\n        })) || [])\n      )\n    }\n  }\n\n  // Validate grid configuration\n  if (layout.grid.columns !== 12) {\n    errors.push({\n      path: 'grid.columns',\n      message: 'Grid must have 12 columns (Bootstrap-like)',\n      code: 'INVALID_GRID_COLUMNS',\n    })\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n"],"names":[],"mappings":";;AAsBO,MAAM,0BAA0C;AAAA,EACrD,eAAe;AAAA,EACf,cAAc;AAAA,EACd,gBAAgB,KAAK;AAAA;AAAA,EACrB,eAAe;AAAA;AACjB;AAMA,MAAM,yBAAyB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAKO,SAAS,qBAAqB,UAAqD;AACxF,QAAM,SAAqC,CAAA;AAG3C,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA;AAAA,MACR;AAAA,IACF;AAAA,EAEJ;AAEA,MAAI,SAAS,WAAW,KAAK,SAAS,WAAW,IAAI;AACnD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,UAAU,KAAK,SAAS,UAAU,IAAI;AACjD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,WAAW,SAAS,UAAU,IAAI,IAAI;AACjD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,aAAa,UAAa,SAAS,WAAW,GAAG;AAC5D,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,YAAY,UAAa,SAAS,UAAU,GAAG;AAC1D,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,uBACd,QACA,SAAyB,yBACP;AAClB,QAAM,SAAqC,CAAA;AAG3C,QAAM,kBAAkB,OAAO,KAAK,SAAS;AAAA,IAC3C,CAAC,KAAK,YAAY,MAAM,QAAQ,KAAK;AAAA,IACrC;AAAA,EAAA;AAGF,MAAI,kBAAkB,OAAO,eAAe;AAC1C,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,kCAAkC,eAAe,MAAM,OAAO,aAAa;AAAA,MACpF,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,QAAM,iBAAiB,OAAO,KAAK,OAAO;AAC1C,aAAW,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,WAAW;AAC7D,QAAI,QAAQ,KAAK,WAAW,gBAAgB;AAC1C,aAAO,KAAK;AAAA,QACV,MAAM,wBAAwB,KAAK;AAAA,QACnC,SAAS,qCAAqC,cAAc,SAAS,QAAQ,KAAK,MAAM;AAAA,QACxF,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AAAA,EACF;AAGA,aAAW,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,WAAW;AAC7D,eAAW,CAAC,WAAW,KAAK,KAAK,QAAQ,KAAK,WAAW;AACvD,UAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,eAAO,KAAK;AAAA,UACV,MAAM,wBAAwB,KAAK,UAAU,SAAS;AAAA,UACtD,SAAS,uBAAuB,KAAK;AAAA,UACrC,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,uBACd,QACA,SAAyB,yBACP;AAClB,QAAM,SAAqC,CAAA;AAG3C,MAAI,OAAO,KAAK,SAAS,OAAO,cAAc;AAC5C,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,2BAA2B,OAAO,KAAK,MAAM,MAAM,OAAO,YAAY;AAAA,MAC/E,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,MAAI,OAAO,QAAQ,WAAW,GAAG;AAC/B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,QAAM,iCAAiB,IAAA;AACvB,aAAW,CAAC,OAAO,MAAM,KAAK,OAAO,QAAQ,WAAW;AACtD,QAAI,WAAW,IAAI,OAAO,GAAG,GAAG;AAC9B,aAAO,KAAK;AAAA,QACV,MAAM,kBAAkB,KAAK;AAAA,QAC7B,SAAS,yBAAyB,OAAO,GAAG;AAAA,QAC5C,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AACA,eAAW,IAAI,OAAO,GAAG;AAAA,EAC3B;AAGA,aAAW,CAAC,UAAU,GAAG,KAAK,OAAO,KAAK,WAAW;AACnD,eAAW,UAAU,OAAO,SAAS;AACnC,UAAI,EAAE,OAAO,OAAO,MAAM;AACxB,eAAO,KAAK;AAAA,UACV,MAAM,eAAe,QAAQ;AAAA,UAC7B,SAAS,uBAAuB,OAAO,GAAG;AAAA,UAC1C,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,oBACd,WACA,SAAyB,yBACP;AAClB,QAAM,cAAc,KAAK,UAAU,SAAS,EAAE;AAE9C,MAAI,cAAc,OAAO,gBAAgB;AACvC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS,+BAA+B,WAAW,MAAM,OAAO,cAAc;AAAA,UAC9E,MAAM;AAAA,QAAA;AAAA,MACR;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO,EAAE,OAAO,KAAA;AAClB;AAMO,SAAS,eAAe,OAAuB;AACpD,SAAO,MACJ,QAAQ,uDAAuD,EAAE,EACjE,QAAQ,mBAAmB,EAAE,EAC7B,QAAQ,iBAAiB,EAAE;AAChC;AAKO,SAAS,qBAAqB,KAA+B;AAClE,MAAI;AACF,UAAM,YAAY,IAAI,IAAI,GAAG;AAC7B,UAAM,SAAS,UAAU;AAEzB,UAAM,YAAY,uBAAuB;AAAA,MACvC,CAAC,YAAY,WAAW,WAAW,OAAO,SAAS,IAAI,OAAO,EAAE,KAAK,YAAY;AAAA,IAAA;AAGnF,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,QACL,OAAO;AAAA,QACP,QAAQ;AAAA,UACN;AAAA,YACE,MAAM;AAAA,YACN,SAAS,2BAA2B,MAAM;AAAA,YAC1C,MAAM;AAAA,UAAA;AAAA,QACR;AAAA,MACF;AAAA,IAEJ;AAEA,WAAO,EAAE,OAAO,KAAA;AAAA,EAClB,SAAS,OAAO;AACd,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA;AAAA,MACR;AAAA,IACF;AAAA,EAEJ;AACF;AAKO,SAAS,kBACd,WACA,SAAyB,yBACP;AAClB,QAAM,SAAqC,CAAA;AAG3C,QAAM,aAAa,qBAAqB,UAAU,QAAQ;AAC1D,MAAI,CAAC,WAAW,OAAO;AACrB,WAAO,KAAK,GAAI,WAAW,UAAU,CAAA,CAAG;AAAA,EAC1C;AAGA,QAAM,aAAa,oBAAoB,WAAW,MAAM;AACxD,MAAI,CAAC,WAAW,OAAO;AACrB,WAAO,KAAK,GAAI,WAAW,UAAU,CAAA,CAAG;AAAA,EAC1C;AAGA,UAAQ,UAAU,MAAA;AAAA,IAChB,KAAK;AACH,YAAM,cAAc,uBAAuB,UAAU,QAAgC,MAAM;AAC3F,UAAI,CAAC,YAAY,OAAO;AACtB,eAAO,KAAK,GAAI,YAAY,UAAU,CAAA,CAAG;AAAA,MAC3C;AACA;AAAA,IAEF,KAAK;AACH,YAAM,cAAc,uBAAuB,UAAU,QAAgC,MAAM;AAC3F,UAAI,CAAC,YAAY,OAAO;AACtB,eAAO,KAAK,GAAI,YAAY,UAAU,CAAA,CAAG;AAAA,MAC3C;AACA;AAAA,IAEF,KAAK;AAEH,YAAM,eAAe,UAAU;AAC/B,UAAI,CAAC,aAAa,SAAS,CAAC,aAAa,OAAO;AAC9C,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IAEF,KAAK;AAEH,YAAM,aAAa,UAAU;AAC7B,UAAI,CAAC,WAAW,SAAS;AACvB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IAEF,KAAK;AAEH,YAAM,eAAe,UAAU;AAC/B,UAAI,CAAC,aAAa,KAAK;AACrB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IAEF,KAAK;AAEH,YAAM,cAAc,UAAU;AAC9B,UAAI,CAAC,YAAY,KAAK;AACpB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IAEF,KAAK;AAEH,YAAM,aAAa,UAAU;AAC7B,UAAI,CAAC,WAAW,KAAK;AACnB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IAEF,KAAK;AAEH,YAAM,eAAe,UAAU;AAC/B,UAAI,CAAC,aAAa,OAAO;AACvB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IAEF;AACE,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS,2BAA2B,UAAU,IAAI;AAAA,QAClD,MAAM;AAAA,MAAA,CACP;AAAA,EAAA;AAGL,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,eACd,QACA,SAAyB,yBACP;;AAClB,QAAM,SAAqC,CAAA;AAG3C,MAAI,OAAO,WAAW,WAAW,GAAG;AAClC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,OAAO,WAAW,SAAS,IAAI;AACjC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,kCAAkC,OAAO,WAAW,MAAM;AAAA,MACnE,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,aAAW,CAAC,OAAO,SAAS,KAAK,OAAO,WAAW,WAAW;AAC5D,UAAM,SAAS,kBAAkB,WAAW,MAAM;AAClD,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO;AAAA,QACL,KAAI,YAAO,WAAP,mBAAe,IAAI,CAAC,WAAW;AAAA,UACjC,GAAG;AAAA,UACH,MAAM,cAAc,KAAK,KAAK,MAAM,IAAI;AAAA,QAAA,QACnC,CAAA;AAAA,MAAC;AAAA,IAEZ;AAAA,EACF;AAGA,MAAI,OAAO,KAAK,YAAY,IAAI;AAC9B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;;;;;;;;;;"}
+{"version":3,"file":"validation.cjs","sources":["../../src/services/validation.ts"],"sourcesContent":["/**\n * Component Validation Service\n * Phase 0: Resource Limits & Schema Validation\n *\n * Validates LLM-generated components against:\n * - JSON schema\n * - Resource limits (data points, payload size, grid bounds)\n * - Security constraints (domain whitelist, XSS prevention)\n */\n\nimport type {\n  UIComponent,\n  UILayout,\n  ValidationResult,\n  ResourceLimits,\n  ChartComponentParams,\n  TableComponentParams,\n  FormFieldParams,\n  IframePolicy,\n  ValidationOptions,\n} from '../types'\n\n/**\n * Default resource limits (configurable via env)\n */\nexport const DEFAULT_RESOURCE_LIMITS: ResourceLimits = {\n  maxDataPoints: 1000,\n  maxTableRows: 100,\n  maxPayloadSize: 50 * 1024, // 50KB\n  renderTimeout: 5000, // 5 seconds\n}\n\n/**\n * Default allowed iframe domains (whitelist)\n * Must match CSP frame-src directive\n * Updated Sprint 7: Added code, design, docs, and map providers\n *\n * This list is exported for transparency and can be extended via ValidationOptions\n */\nexport const DEFAULT_IFRAME_DOMAINS = [\n  // Charts\n  'quickchart.io',\n  'www.quickchart.io',\n\n  // Deposium\n  'deposium.com',\n  'deposium.vip',\n  'deposium.ai',\n\n  // Development\n  'localhost',\n\n  // Video providers (Sprint 5)\n  'youtube.com',\n  'www.youtube.com',\n  'youtube-nocookie.com',\n  'www.youtube-nocookie.com',\n  'youtu.be',\n  'vimeo.com',\n  'player.vimeo.com',\n\n  // Code playgrounds (Sprint 7)\n  'codepen.io',\n  'codesandbox.io',\n  'stackblitz.com',\n  'jsfiddle.net',\n\n  // Design tools (Sprint 7)\n  'figma.com',\n  'www.figma.com',\n  'miro.com',\n\n  // Google services (Sprint 7)\n  'docs.google.com',\n  'drive.google.com',\n  'sheets.google.com',\n  'slides.google.com',\n  'maps.google.com',\n  'www.google.com',\n  'datastudio.google.com',\n  'lookerstudio.google.com',\n\n  // Productivity (Sprint 7)\n  'airtable.com',\n  'notion.so',\n  'www.notion.so',\n\n  // Maps (Sprint 7)\n  'openstreetmap.org',\n  'www.openstreetmap.org',\n\n  // Analytics/Dashboards (Sprint 7)\n  'public.tableau.com',\n]\n\n/**\n * Validate grid position bounds (1-12 columns)\n */\nexport function validateGridPosition(position: UIComponent['position']): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // ✅ PHASE 3 FIX: Defensive check for undefined position\n  if (!position) {\n    return {\n      valid: false,\n      errors: [\n        {\n          path: 'position',\n          message: 'Position is required',\n          code: 'MISSING_POSITION',\n        },\n      ],\n    }\n  }\n\n  if (position.colStart < 1 || position.colStart > 12) {\n    errors.push({\n      path: 'position.colStart',\n      message: 'Column start must be between 1 and 12',\n      code: 'INVALID_GRID_COL_START',\n    })\n  }\n\n  if (position.colSpan < 1 || position.colSpan > 12) {\n    errors.push({\n      path: 'position.colSpan',\n      message: 'Column span must be between 1 and 12',\n      code: 'INVALID_GRID_COL_SPAN',\n    })\n  }\n\n  if (position.colStart + position.colSpan - 1 > 12) {\n    errors.push({\n      path: 'position',\n      message: 'Column start + span exceeds grid width (12)',\n      code: 'GRID_OVERFLOW',\n    })\n  }\n\n  if (position.rowStart !== undefined && position.rowStart < 1) {\n    errors.push({\n      path: 'position.rowStart',\n      message: 'Row start must be >= 1',\n      code: 'INVALID_GRID_ROW_START',\n    })\n  }\n\n  if (position.rowSpan !== undefined && position.rowSpan < 1) {\n    errors.push({\n      path: 'position.rowSpan',\n      message: 'Row span must be >= 1',\n      code: 'INVALID_GRID_ROW_SPAN',\n    })\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate chart component against resource limits\n */\nexport function validateChartComponent(\n  params: ChartComponentParams,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // Validate data points count\n  const totalDataPoints = params.data.datasets.reduce(\n    (sum, dataset) => sum + dataset.data.length,\n    0\n  )\n\n  if (totalDataPoints > limits.maxDataPoints) {\n    errors.push({\n      path: 'params.data',\n      message: `Chart exceeds max data points: ${totalDataPoints} > ${limits.maxDataPoints}`,\n      code: 'RESOURCE_LIMIT_EXCEEDED',\n    })\n  }\n\n  // Validate labels match dataset length\n  const expectedLength = params.data.labels.length\n  for (const [index, dataset] of params.data.datasets.entries()) {\n    if (dataset.data.length !== expectedLength) {\n      errors.push({\n        path: `params.data.datasets[${index}]`,\n        message: `Dataset length mismatch: expected ${expectedLength}, got ${dataset.data.length}`,\n        code: 'DATA_LENGTH_MISMATCH',\n      })\n    }\n  }\n\n  // Validate numeric data\n  for (const [index, dataset] of params.data.datasets.entries()) {\n    for (const [dataIndex, value] of dataset.data.entries()) {\n      if (typeof value !== 'number' || !Number.isFinite(value)) {\n        errors.push({\n          path: `params.data.datasets[${index}].data[${dataIndex}]`,\n          message: `Invalid data value: ${value} (must be finite number)`,\n          code: 'INVALID_DATA_TYPE',\n        })\n      }\n    }\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate table component against resource limits\n */\nexport function validateTableComponent(\n  params: TableComponentParams,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // Validate row count\n  if (params.rows.length > limits.maxTableRows) {\n    errors.push({\n      path: 'params.rows',\n      message: `Table exceeds max rows: ${params.rows.length} > ${limits.maxTableRows}`,\n      code: 'RESOURCE_LIMIT_EXCEEDED',\n    })\n  }\n\n  // Validate columns\n  if (params.columns.length === 0) {\n    errors.push({\n      path: 'params.columns',\n      message: 'Table must have at least one column',\n      code: 'EMPTY_COLUMNS',\n    })\n  }\n\n  // Validate column keys are unique\n  const columnKeys = new Set<string>()\n  for (const [index, column] of params.columns.entries()) {\n    if (columnKeys.has(column.key)) {\n      errors.push({\n        path: `params.columns[${index}]`,\n        message: `Duplicate column key: ${column.key}`,\n        code: 'DUPLICATE_COLUMN_KEY',\n      })\n    }\n    columnKeys.add(column.key)\n  }\n\n  // Validate rows have valid data for defined columns\n  for (const [rowIndex, row] of params.rows.entries()) {\n    for (const column of params.columns) {\n      if (!(column.key in row)) {\n        errors.push({\n          path: `params.rows[${rowIndex}]`,\n          message: `Missing column key: ${column.key}`,\n          code: 'MISSING_COLUMN_DATA',\n        })\n      }\n    }\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate payload size\n */\nexport function validatePayloadSize(\n  component: UIComponent,\n  limits: ResourceLimits = DEFAULT_RESOURCE_LIMITS\n): ValidationResult {\n  const payloadSize = JSON.stringify(component).length\n\n  if (payloadSize > limits.maxPayloadSize) {\n    return {\n      valid: false,\n      errors: [\n        {\n          path: 'component',\n          message: `Payload size exceeds limit: ${payloadSize} > ${limits.maxPayloadSize} bytes`,\n          code: 'PAYLOAD_TOO_LARGE',\n        },\n      ],\n    }\n  }\n\n  return { valid: true }\n}\n\n/**\n * Sanitize string to prevent XSS\n * Basic implementation - DOMPurify used at render time\n */\nexport function sanitizeString(input: string): string {\n  return input\n    .replace(/<script\\b[^<]*(?:(?!<\\/script>)<[^<]*)*<\\/script>/gi, '')\n    .replace(/on\\w+=\"[^\"]*\"/gi, '')\n    .replace(/javascript:/gi, '')\n}\n\n/**\n * Validate iframe domain against whitelist\n *\n * @param url - The URL to validate\n * @param options - Optional validation options\n * @param options.policy - 'strict' (default), 'extend', or 'allow-all'\n * @param options.customDomains - Additional domains when policy is 'extend'\n */\nexport function validateIframeDomain(\n  url: string,\n  options?: { policy?: IframePolicy; customDomains?: string[] }\n): ValidationResult {\n  // If allow-all, skip validation\n  if (options?.policy === 'allow-all') {\n    return { valid: true }\n  }\n\n  try {\n    const parsedUrl = new URL(url)\n    const domain = parsedUrl.hostname\n\n    // Build effective whitelist\n    let effectiveWhitelist = DEFAULT_IFRAME_DOMAINS\n    if (options?.policy === 'extend' && options.customDomains) {\n      effectiveWhitelist = [...DEFAULT_IFRAME_DOMAINS, ...options.customDomains]\n    }\n\n    const isAllowed = effectiveWhitelist.some(\n      (allowed) => domain === allowed || domain.endsWith(`.${allowed}`) || allowed === 'localhost'\n    )\n\n    if (!isAllowed) {\n      return {\n        valid: false,\n        errors: [\n          {\n            path: 'url',\n            message: `Domain not whitelisted: ${domain}`,\n            code: 'DOMAIN_NOT_WHITELISTED',\n          },\n        ],\n      }\n    }\n\n    return { valid: true }\n  } catch (error) {\n    return {\n      valid: false,\n      errors: [\n        {\n          path: 'url',\n          message: 'Invalid URL format',\n          code: 'INVALID_URL',\n        },\n      ],\n    }\n  }\n}\n\n/**\n * Validate entire component\n *\n * @param component - The component to validate\n * @param options - Optional validation options (limits, iframePolicy, customIframeDomains)\n */\nexport function validateComponent(\n  component: UIComponent,\n  options?: ValidationOptions\n): ValidationResult {\n  const limits = options?.limits ?? DEFAULT_RESOURCE_LIMITS\n  const errors: ValidationResult['errors'] = []\n\n  // Validate grid position\n  const gridResult = validateGridPosition(component.position)\n  if (!gridResult.valid) {\n    errors.push(...(gridResult.errors || []))\n  }\n\n  // Validate payload size\n  const sizeResult = validatePayloadSize(component, limits)\n  if (!sizeResult.valid) {\n    errors.push(...(sizeResult.errors || []))\n  }\n\n  // Type-specific validation\n  switch (component.type) {\n    case 'chart': {\n      const chartResult = validateChartComponent(component.params as ChartComponentParams, limits)\n      if (!chartResult.valid) {\n        errors.push(...(chartResult.errors || []))\n      }\n      break\n    }\n\n    case 'table': {\n      const tableResult = validateTableComponent(component.params as TableComponentParams, limits)\n      if (!tableResult.valid) {\n        errors.push(...(tableResult.errors || []))\n      }\n      break\n    }\n\n    case 'metric': {\n      // Basic validation for metrics\n      const metricParams = component.params as any\n      if (!metricParams.title || !metricParams.value) {\n        errors.push({\n          path: 'params',\n          message: 'Metric must have title and value',\n          code: 'INVALID_METRIC',\n        })\n      }\n      break\n    }\n\n    case 'text': {\n      // Basic validation for text\n      const textParams = component.params as any\n      if (!textParams.content) {\n        errors.push({\n          path: 'params',\n          message: 'Text component must have content',\n          code: 'INVALID_TEXT',\n        })\n      }\n      break\n    }\n\n    case 'iframe': {\n      // Basic validation for iframe\n      const iframeParams = component.params as any\n      if (!iframeParams.url) {\n        errors.push({\n          path: 'params',\n          message: 'Iframe component must have url',\n          code: 'INVALID_IFRAME',\n        })\n      } else {\n        // Validate iframe domain against whitelist\n        const iframeResult = validateIframeDomain(iframeParams.url, {\n          policy: options?.iframePolicy,\n          customDomains: options?.customIframeDomains,\n        })\n        if (!iframeResult.valid) {\n          errors.push(...(iframeResult.errors || []))\n        }\n      }\n      break\n    }\n\n    case 'image': {\n      // Basic validation for image\n      const imageParams = component.params as any\n      if (!imageParams.url) {\n        errors.push({\n          path: 'params',\n          message: 'Image component must have url',\n          code: 'INVALID_IMAGE',\n        })\n      }\n      break\n    }\n\n    case 'link': {\n      // Basic validation for link\n      const linkParams = component.params as any\n      if (!linkParams.url) {\n        errors.push({\n          path: 'params',\n          message: 'Link component must have url',\n          code: 'INVALID_LINK',\n        })\n      }\n      break\n    }\n\n    case 'action': {\n      // Basic validation for action\n      const actionParams = component.params as any\n      if (!actionParams.label) {\n        errors.push({\n          path: 'params',\n          message: 'Action component must have label',\n          code: 'INVALID_ACTION',\n        })\n      }\n      break\n    }\n\n    default:\n      errors.push({\n        path: 'type',\n        message: `Unknown component type: ${component.type}`,\n        code: 'UNKNOWN_COMPONENT_TYPE',\n      })\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate entire layout\n *\n * @param layout - The layout to validate\n * @param options - Optional validation options (limits, iframePolicy, customIframeDomains)\n */\nexport function validateLayout(\n  layout: UILayout,\n  options?: ValidationOptions\n): ValidationResult {\n  const errors: ValidationResult['errors'] = []\n\n  // Validate component count\n  if (layout.components.length === 0) {\n    errors.push({\n      path: 'components',\n      message: 'Layout must have at least one component',\n      code: 'EMPTY_LAYOUT',\n    })\n  }\n\n  if (layout.components.length > 12) {\n    errors.push({\n      path: 'components',\n      message: `Layout exceeds max components: ${layout.components.length} > 12`,\n      code: 'TOO_MANY_COMPONENTS',\n    })\n  }\n\n  // Validate each component\n  for (const [index, component] of layout.components.entries()) {\n    const result = validateComponent(component, options)\n    if (!result.valid) {\n      errors.push(\n        ...(result.errors?.map((error) => ({\n          ...error,\n          path: `components[${index}].${error.path}`,\n        })) || [])\n      )\n    }\n  }\n\n  // Validate grid configuration\n  if (layout.grid.columns !== 12) {\n    errors.push({\n      path: 'grid.columns',\n      message: 'Grid must have 12 columns (Bootstrap-like)',\n      code: 'INVALID_GRID_COLUMNS',\n    })\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors: errors.length > 0 ? errors : undefined,\n  }\n}\n\n/**\n * Validate a single form field value against field rules\n */\nexport function validateFieldValue(\n  value: any,\n  field: FormFieldParams\n): { valid: boolean; error?: string } {\n  // Required check\n  if (field.required) {\n    if (value === undefined || value === null || value === '') {\n      return { valid: false, error: `${field.label || field.name} is required` }\n    }\n    if (field.type === 'checkbox' && value !== true) {\n      return { valid: false, error: `${field.label || field.name} must be checked` }\n    }\n  }\n\n  // Skip further validation if value is empty and not required\n  if (value === undefined || value === null || value === '') {\n    return { valid: true }\n  }\n\n  // Type-specific validation\n  switch (field.type) {\n    case 'text':\n    case 'textarea':\n    case 'password':\n      if (field.minLength && String(value).length < field.minLength) {\n        return { valid: false, error: `Minimum ${field.minLength} characters required` }\n      }\n      if (field.maxLength && String(value).length > field.maxLength) {\n        return { valid: false, error: `Maximum ${field.maxLength} characters allowed` }\n      }\n      if (field.pattern && !new RegExp(field.pattern).test(String(value))) {\n        return { valid: false, error: 'Invalid format' }\n      }\n      break\n\n    case 'email':\n      if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(String(value))) {\n        return { valid: false, error: 'Invalid email address' }\n      }\n      break\n\n    case 'number': {\n      const numValue = Number(value)\n      if (isNaN(numValue)) {\n        return { valid: false, error: 'Must be a valid number' }\n      }\n      if (field.min !== undefined && numValue < field.min) {\n        return { valid: false, error: `Minimum value is ${field.min}` }\n      }\n      if (field.max !== undefined && numValue > field.max) {\n        return { valid: false, error: `Maximum value is ${field.max}` }\n      }\n      break\n    }\n\n    case 'date':\n      if (field.minDate && value < field.minDate) {\n        return { valid: false, error: `Date must be after ${field.minDate}` }\n      }\n      if (field.maxDate && value > field.maxDate) {\n        return { valid: false, error: `Date must be before ${field.maxDate}` }\n      }\n      break\n\n    case 'select':\n    case 'radio':\n      // Validate that value is one of the options\n      if (field.options && field.options.length > 0) {\n        const validValues = field.options.map((opt) => opt.value)\n        if (!validValues.includes(String(value))) {\n          return { valid: false, error: 'Please select a valid option' }\n        }\n      }\n      break\n  }\n\n  return { valid: true }\n}\n\n/**\n * Validate entire form data against field definitions\n */\nexport function validateFormData(\n  data: Record<string, any>,\n  fields: FormFieldParams[]\n): { valid: boolean; errors: Record<string, string> } {\n  const errors: Record<string, string> = {}\n\n  for (const field of fields) {\n    const result = validateFieldValue(data[field.name], field)\n    if (!result.valid && result.error) {\n      errors[field.name] = result.error\n    }\n  }\n\n  return {\n    valid: Object.keys(errors).length === 0,\n    errors,\n  }\n}\n"],"names":[],"mappings":";;AAyBO,MAAM,0BAA0C;AAAA,EACrD,eAAe;AAAA,EACf,cAAc;AAAA,EACd,gBAAgB,KAAK;AAAA;AAAA,EACrB,eAAe;AAAA;AACjB;AASO,MAAM,yBAAyB;AAAA;AAAA,EAEpC;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAGA;AACF;AAKO,SAAS,qBAAqB,UAAqD;AACxF,QAAM,SAAqC,CAAA;AAG3C,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA;AAAA,MACR;AAAA,IACF;AAAA,EAEJ;AAEA,MAAI,SAAS,WAAW,KAAK,SAAS,WAAW,IAAI;AACnD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,UAAU,KAAK,SAAS,UAAU,IAAI;AACjD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,WAAW,SAAS,UAAU,IAAI,IAAI;AACjD,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,aAAa,UAAa,SAAS,WAAW,GAAG;AAC5D,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,SAAS,YAAY,UAAa,SAAS,UAAU,GAAG;AAC1D,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,uBACd,QACA,SAAyB,yBACP;AAClB,QAAM,SAAqC,CAAA;AAG3C,QAAM,kBAAkB,OAAO,KAAK,SAAS;AAAA,IAC3C,CAAC,KAAK,YAAY,MAAM,QAAQ,KAAK;AAAA,IACrC;AAAA,EAAA;AAGF,MAAI,kBAAkB,OAAO,eAAe;AAC1C,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,kCAAkC,eAAe,MAAM,OAAO,aAAa;AAAA,MACpF,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,QAAM,iBAAiB,OAAO,KAAK,OAAO;AAC1C,aAAW,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,WAAW;AAC7D,QAAI,QAAQ,KAAK,WAAW,gBAAgB;AAC1C,aAAO,KAAK;AAAA,QACV,MAAM,wBAAwB,KAAK;AAAA,QACnC,SAAS,qCAAqC,cAAc,SAAS,QAAQ,KAAK,MAAM;AAAA,QACxF,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AAAA,EACF;AAGA,aAAW,CAAC,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,WAAW;AAC7D,eAAW,CAAC,WAAW,KAAK,KAAK,QAAQ,KAAK,WAAW;AACvD,UAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,eAAO,KAAK;AAAA,UACV,MAAM,wBAAwB,KAAK,UAAU,SAAS;AAAA,UACtD,SAAS,uBAAuB,KAAK;AAAA,UACrC,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,uBACd,QACA,SAAyB,yBACP;AAClB,QAAM,SAAqC,CAAA;AAG3C,MAAI,OAAO,KAAK,SAAS,OAAO,cAAc;AAC5C,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,2BAA2B,OAAO,KAAK,MAAM,MAAM,OAAO,YAAY;AAAA,MAC/E,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,MAAI,OAAO,QAAQ,WAAW,GAAG;AAC/B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,QAAM,iCAAiB,IAAA;AACvB,aAAW,CAAC,OAAO,MAAM,KAAK,OAAO,QAAQ,WAAW;AACtD,QAAI,WAAW,IAAI,OAAO,GAAG,GAAG;AAC9B,aAAO,KAAK;AAAA,QACV,MAAM,kBAAkB,KAAK;AAAA,QAC7B,SAAS,yBAAyB,OAAO,GAAG;AAAA,QAC5C,MAAM;AAAA,MAAA,CACP;AAAA,IACH;AACA,eAAW,IAAI,OAAO,GAAG;AAAA,EAC3B;AAGA,aAAW,CAAC,UAAU,GAAG,KAAK,OAAO,KAAK,WAAW;AACnD,eAAW,UAAU,OAAO,SAAS;AACnC,UAAI,EAAE,OAAO,OAAO,MAAM;AACxB,eAAO,KAAK;AAAA,UACV,MAAM,eAAe,QAAQ;AAAA,UAC7B,SAAS,uBAAuB,OAAO,GAAG;AAAA,UAC1C,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,oBACd,WACA,SAAyB,yBACP;AAClB,QAAM,cAAc,KAAK,UAAU,SAAS,EAAE;AAE9C,MAAI,cAAc,OAAO,gBAAgB;AACvC,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS,+BAA+B,WAAW,MAAM,OAAO,cAAc;AAAA,UAC9E,MAAM;AAAA,QAAA;AAAA,MACR;AAAA,IACF;AAAA,EAEJ;AAEA,SAAO,EAAE,OAAO,KAAA;AAClB;AAMO,SAAS,eAAe,OAAuB;AACpD,SAAO,MACJ,QAAQ,uDAAuD,EAAE,EACjE,QAAQ,mBAAmB,EAAE,EAC7B,QAAQ,iBAAiB,EAAE;AAChC;AAUO,SAAS,qBACd,KACA,SACkB;AAElB,OAAI,mCAAS,YAAW,aAAa;AACnC,WAAO,EAAE,OAAO,KAAA;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,YAAY,IAAI,IAAI,GAAG;AAC7B,UAAM,SAAS,UAAU;AAGzB,QAAI,qBAAqB;AACzB,SAAI,mCAAS,YAAW,YAAY,QAAQ,eAAe;AACzD,2BAAqB,CAAC,GAAG,wBAAwB,GAAG,QAAQ,aAAa;AAAA,IAC3E;AAEA,UAAM,YAAY,mBAAmB;AAAA,MACnC,CAAC,YAAY,WAAW,WAAW,OAAO,SAAS,IAAI,OAAO,EAAE,KAAK,YAAY;AAAA,IAAA;AAGnF,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,QACL,OAAO;AAAA,QACP,QAAQ;AAAA,UACN;AAAA,YACE,MAAM;AAAA,YACN,SAAS,2BAA2B,MAAM;AAAA,YAC1C,MAAM;AAAA,UAAA;AAAA,QACR;AAAA,MACF;AAAA,IAEJ;AAEA,WAAO,EAAE,OAAO,KAAA;AAAA,EAClB,SAAS,OAAO;AACd,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA;AAAA,MACR;AAAA,IACF;AAAA,EAEJ;AACF;AAQO,SAAS,kBACd,WACA,SACkB;AAClB,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,SAAqC,CAAA;AAG3C,QAAM,aAAa,qBAAqB,UAAU,QAAQ;AAC1D,MAAI,CAAC,WAAW,OAAO;AACrB,WAAO,KAAK,GAAI,WAAW,UAAU,CAAA,CAAG;AAAA,EAC1C;AAGA,QAAM,aAAa,oBAAoB,WAAW,MAAM;AACxD,MAAI,CAAC,WAAW,OAAO;AACrB,WAAO,KAAK,GAAI,WAAW,UAAU,CAAA,CAAG;AAAA,EAC1C;AAGA,UAAQ,UAAU,MAAA;AAAA,IAChB,KAAK,SAAS;AACZ,YAAM,cAAc,uBAAuB,UAAU,QAAgC,MAAM;AAC3F,UAAI,CAAC,YAAY,OAAO;AACtB,eAAO,KAAK,GAAI,YAAY,UAAU,CAAA,CAAG;AAAA,MAC3C;AACA;AAAA,IACF;AAAA,IAEA,KAAK,SAAS;AACZ,YAAM,cAAc,uBAAuB,UAAU,QAAgC,MAAM;AAC3F,UAAI,CAAC,YAAY,OAAO;AACtB,eAAO,KAAK,GAAI,YAAY,UAAU,CAAA,CAAG;AAAA,MAC3C;AACA;AAAA,IACF;AAAA,IAEA,KAAK,UAAU;AAEb,YAAM,eAAe,UAAU;AAC/B,UAAI,CAAC,aAAa,SAAS,CAAC,aAAa,OAAO;AAC9C,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IACF;AAAA,IAEA,KAAK,QAAQ;AAEX,YAAM,aAAa,UAAU;AAC7B,UAAI,CAAC,WAAW,SAAS;AACvB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IACF;AAAA,IAEA,KAAK,UAAU;AAEb,YAAM,eAAe,UAAU;AAC/B,UAAI,CAAC,aAAa,KAAK;AACrB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH,OAAO;AAEL,cAAM,eAAe,qBAAqB,aAAa,KAAK;AAAA,UAC1D,QAAQ,mCAAS;AAAA,UACjB,eAAe,mCAAS;AAAA,QAAA,CACzB;AACD,YAAI,CAAC,aAAa,OAAO;AACvB,iBAAO,KAAK,GAAI,aAAa,UAAU,CAAA,CAAG;AAAA,QAC5C;AAAA,MACF;AACA;AAAA,IACF;AAAA,IAEA,KAAK,SAAS;AAEZ,YAAM,cAAc,UAAU;AAC9B,UAAI,CAAC,YAAY,KAAK;AACpB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IACF;AAAA,IAEA,KAAK,QAAQ;AAEX,YAAM,aAAa,UAAU;AAC7B,UAAI,CAAC,WAAW,KAAK;AACnB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IACF;AAAA,IAEA,KAAK,UAAU;AAEb,YAAM,eAAe,UAAU;AAC/B,UAAI,CAAC,aAAa,OAAO;AACvB,eAAO,KAAK;AAAA,UACV,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA,QAAA,CACP;AAAA,MACH;AACA;AAAA,IACF;AAAA,IAEA;AACE,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,SAAS,2BAA2B,UAAU,IAAI;AAAA,QAClD,MAAM;AAAA,MAAA,CACP;AAAA,EAAA;AAGL,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAQO,SAAS,eACd,QACA,SACkB;;AAClB,QAAM,SAAqC,CAAA;AAG3C,MAAI,OAAO,WAAW,WAAW,GAAG;AAClC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,MAAI,OAAO,WAAW,SAAS,IAAI;AACjC,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS,kCAAkC,OAAO,WAAW,MAAM;AAAA,MACnE,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAGA,aAAW,CAAC,OAAO,SAAS,KAAK,OAAO,WAAW,WAAW;AAC5D,UAAM,SAAS,kBAAkB,WAAW,OAAO;AACnD,QAAI,CAAC,OAAO,OAAO;AACjB,aAAO;AAAA,QACL,KAAI,YAAO,WAAP,mBAAe,IAAI,CAAC,WAAW;AAAA,UACjC,GAAG;AAAA,UACH,MAAM,cAAc,KAAK,KAAK,MAAM,IAAI;AAAA,QAAA,QACnC,CAAA;AAAA,MAAC;AAAA,IAEZ;AAAA,EACF;AAGA,MAAI,OAAO,KAAK,YAAY,IAAI;AAC9B,WAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,IAAA,CACP;AAAA,EACH;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,QAAQ,OAAO,SAAS,IAAI,SAAS;AAAA,EAAA;AAEzC;AAKO,SAAS,mBACd,OACA,OACoC;AAEpC,MAAI,MAAM,UAAU;AAClB,QAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,aAAO,EAAE,OAAO,OAAO,OAAO,GAAG,MAAM,SAAS,MAAM,IAAI,eAAA;AAAA,IAC5D;AACA,QAAI,MAAM,SAAS,cAAc,UAAU,MAAM;AAC/C,aAAO,EAAE,OAAO,OAAO,OAAO,GAAG,MAAM,SAAS,MAAM,IAAI,mBAAA;AAAA,IAC5D;AAAA,EACF;AAGA,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,WAAO,EAAE,OAAO,KAAA;AAAA,EAClB;AAGA,UAAQ,MAAM,MAAA;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,MAAM,aAAa,OAAO,KAAK,EAAE,SAAS,MAAM,WAAW;AAC7D,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,MAAM,SAAS,uBAAA;AAAA,MAC1D;AACA,UAAI,MAAM,aAAa,OAAO,KAAK,EAAE,SAAS,MAAM,WAAW;AAC7D,eAAO,EAAE,OAAO,OAAO,OAAO,WAAW,MAAM,SAAS,sBAAA;AAAA,MAC1D;AACA,UAAI,MAAM,WAAW,CAAC,IAAI,OAAO,MAAM,OAAO,EAAE,KAAK,OAAO,KAAK,CAAC,GAAG;AACnE,eAAO,EAAE,OAAO,OAAO,OAAO,iBAAA;AAAA,MAChC;AACA;AAAA,IAEF,KAAK;AACH,UAAI,CAAC,6BAA6B,KAAK,OAAO,KAAK,CAAC,GAAG;AACrD,eAAO,EAAE,OAAO,OAAO,OAAO,wBAAA;AAAA,MAChC;AACA;AAAA,IAEF,KAAK,UAAU;AACb,YAAM,WAAW,OAAO,KAAK;AAC7B,UAAI,MAAM,QAAQ,GAAG;AACnB,eAAO,EAAE,OAAO,OAAO,OAAO,yBAAA;AAAA,MAChC;AACA,UAAI,MAAM,QAAQ,UAAa,WAAW,MAAM,KAAK;AACnD,eAAO,EAAE,OAAO,OAAO,OAAO,oBAAoB,MAAM,GAAG,GAAA;AAAA,MAC7D;AACA,UAAI,MAAM,QAAQ,UAAa,WAAW,MAAM,KAAK;AACnD,eAAO,EAAE,OAAO,OAAO,OAAO,oBAAoB,MAAM,GAAG,GAAA;AAAA,MAC7D;AACA;AAAA,IACF;AAAA,IAEA,KAAK;AACH,UAAI,MAAM,WAAW,QAAQ,MAAM,SAAS;AAC1C,eAAO,EAAE,OAAO,OAAO,OAAO,sBAAsB,MAAM,OAAO,GAAA;AAAA,MACnE;AACA,UAAI,MAAM,WAAW,QAAQ,MAAM,SAAS;AAC1C,eAAO,EAAE,OAAO,OAAO,OAAO,uBAAuB,MAAM,OAAO,GAAA;AAAA,MACpE;AACA;AAAA,IAEF,KAAK;AAAA,IACL,KAAK;AAEH,UAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,GAAG;AAC7C,cAAM,cAAc,MAAM,QAAQ,IAAI,CAAC,QAAQ,IAAI,KAAK;AACxD,YAAI,CAAC,YAAY,SAAS,OAAO,KAAK,CAAC,GAAG;AACxC,iBAAO,EAAE,OAAO,OAAO,OAAO,+BAAA;AAAA,QAChC;AAAA,MACF;AACA;AAAA,EAAA;AAGJ,SAAO,EAAE,OAAO,KAAA;AAClB;AAKO,SAAS,iBACd,MACA,QACoD;AACpD,QAAM,SAAiC,CAAA;AAEvC,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,mBAAmB,KAAK,MAAM,IAAI,GAAG,KAAK;AACzD,QAAI,CAAC,OAAO,SAAS,OAAO,OAAO;AACjC,aAAO,MAAM,IAAI,IAAI,OAAO;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,OAAO,KAAK,MAAM,EAAE,WAAW;AAAA,IACtC;AAAA,EAAA;AAEJ;;;;;;;;;;;;;"}

package/dist/services/validation.d.ts

@@ -7,11 +7,19 @@
  * - Resource limits (data points, payload size, grid bounds)
  * - Security constraints (domain whitelist, XSS prevention)
  */
-import type { UIComponent, UILayout, ValidationResult, ResourceLimits, ChartComponentParams, TableComponentParams } from '../types';
+import type { UIComponent, UILayout, ValidationResult, ResourceLimits, ChartComponentParams, TableComponentParams, FormFieldParams, IframePolicy, ValidationOptions } from '../types';
 /**
  * Default resource limits (configurable via env)
  */
 export declare const DEFAULT_RESOURCE_LIMITS: ResourceLimits;
+/**
+ * Default allowed iframe domains (whitelist)
+ * Must match CSP frame-src directive
+ * Updated Sprint 7: Added code, design, docs, and map providers
+ *
+ * This list is exported for transparency and can be extended via ValidationOptions
+ */
+export declare const DEFAULT_IFRAME_DOMAINS: string[];
 /**
  * Validate grid position bounds (1-12 columns)
  */
@@ -35,14 +43,42 @@ export declare function validatePayloadSize(component: UIComponent, limits?: Res
 export declare function sanitizeString(input: string): string;
 /**
  * Validate iframe domain against whitelist
+ *
+ * @param url - The URL to validate
+ * @param options - Optional validation options
+ * @param options.policy - 'strict' (default), 'extend', or 'allow-all'
+ * @param options.customDomains - Additional domains when policy is 'extend'
  */
-export declare function validateIframeDomain(url: string): ValidationResult;
+export declare function validateIframeDomain(url: string, options?: {
+    policy?: IframePolicy;
+    customDomains?: string[];
+}): ValidationResult;
 /**
  * Validate entire component
+ *
+ * @param component - The component to validate
+ * @param options - Optional validation options (limits, iframePolicy, customIframeDomains)
  */
-export declare function validateComponent(component: UIComponent, limits?: ResourceLimits): ValidationResult;
+export declare function validateComponent(component: UIComponent, options?: ValidationOptions): ValidationResult;
 /**
  * Validate entire layout
+ *
+ * @param layout - The layout to validate
+ * @param options - Optional validation options (limits, iframePolicy, customIframeDomains)
+ */
+export declare function validateLayout(layout: UILayout, options?: ValidationOptions): ValidationResult;
+/**
+ * Validate a single form field value against field rules
+ */
+export declare function validateFieldValue(value: any, field: FormFieldParams): {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Validate entire form data against field definitions
  */
-export declare function validateLayout(layout: UILayout, limits?: ResourceLimits): ValidationResult;
+export declare function validateFormData(data: Record<string, any>, fields: FormFieldParams[]): {
+    valid: boolean;
+    errors: Record<string, string>;
+};
 //# sourceMappingURL=validation.d.ts.map

package/dist/services/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/services/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,UAAU,CAAA;AAEjB;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAKrC,CAAA;AAcD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,gBAAgB,CA6DxF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CA8ClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CAmDlB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,WAAW,EACtB,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CAiBlB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAmClE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,WAAW,EACtB,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CAmHlB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,EAChB,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CA8ClB"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/services/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,iBAAiB,EAClB,MAAM,UAAU,CAAA;AAEjB;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAKrC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,UAsDlC,CAAA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,gBAAgB,CA6DxF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CA8ClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CAmDlB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,WAAW,EACtB,MAAM,GAAE,cAAwC,GAC/C,gBAAgB,CAiBlB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC5D,gBAAgB,CA8ClB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,WAAW,EACtB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,gBAAgB,CAqIlB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,QAAQ,EAChB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,gBAAgB,CA8ClB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,eAAe,GACrB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA0EpC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,eAAe,EAAE,GACxB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAcpD"}